git: 28e89934a9be - main - rtwn: fix mbuf allocation errors in USB RX path for > 4 KiB frames

The branch main has been updated by adrian:

URL: https://cgit.FreeBSD.org/src/commit/?id=28e89934a9bec3eca08f4d291a5699485c29d203

commit 28e89934a9bec3eca08f4d291a5699485c29d203
Author:     Adrian Chadd <adrian@FreeBSD.org>
AuthorDate: 2025-04-27 23:50:51 +0000
Commit:     Adrian Chadd <adrian@FreeBSD.org>
CommitDate: 2025-05-01 03:01:05 +0000

    rtwn: fix mbuf allocation errors in USB RX path for > 4 KiB frames
    
    We can and do receive > 4 KiB frames in the RX path (A-MSDU frames
    can be up to 11KiB.)  At least one user has reported seeing this
    and having it break their traffic flows.
    
    Use m_get3() to try and grab an mbuf jumbo cluster.
    
    This may not be the best permanent solution, but it at least will
    fail for frame sizes we expect to see up and including the largest
    A-MPDU frame (11Kib)  and keep a counter if it can't allocate, versus
    just returning NULL because it's too large (and not keeping counters.)
    
    Differential Revision:  https://reviews.freebsd.org/D50049
    PR:     kern/286366
    Reviewed by:    bz
---
 sys/dev/rtwn/usb/rtwn_usb_rx.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/sys/dev/rtwn/usb/rtwn_usb_rx.c b/sys/dev/rtwn/usb/rtwn_usb_rx.c
index 657d6bdeb9e4..4a4294c0d890 100644
--- a/sys/dev/rtwn/usb/rtwn_usb_rx.c
+++ b/sys/dev/rtwn/usb/rtwn_usb_rx.c
@@ -124,10 +124,15 @@ rtwn_rx_copy_to_mbuf(struct rtwn_softc *sc, struct rtwn_rx_stat_common *stat,
 	if (rtwn_rx_check_pre_alloc(sc, stat) != 0)
 		goto fail;
 
-	m = m_get2(totlen, M_NOWAIT, MT_DATA, M_PKTHDR);
+	/*
+	 * Note: this can require >4 KiB (eg de-aggregating an A-MSDU
+	 * from an USB frame.  See kern/286366 for more information.
+	 */
+	m = m_get3(totlen, M_NOWAIT, MT_DATA, M_PKTHDR);
 	if (__predict_false(m == NULL)) {
-		device_printf(sc->sc_dev, "%s: could not allocate RX mbuf\n",
-		    __func__);
+		device_printf(sc->sc_dev,
+		    "%s: could not allocate RX mbuf (%d bytes)\n",
+		    __func__, totlen);
 		goto fail;
 	}